Analysis
- max time kernel
150s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_065936aba97131cf14b9dde1fa5fc1c7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_065936aba97131cf14b9dde1fa5fc1c7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_065936aba97131cf14b9dde1fa5fc1c7_elex_mafia_stealc_tofsee.exe
- Size 486KB
- Sample260802-btaktsbd24
- SHA256 66226959b3db684fa43b077fa2754c7ffeae88b6415f337ec68cf0822f9beb1d
- MD5 065936aba97131cf14b9dde1fa5fc1c7
- SHA1 a402c4ea58ee3aa291e04e1858261472408bb47f
- SHA512 7b4f3e08f0b0353b246613e4af75d2d45ad439d746522e46d51c9574d30a5afb0f978de4b26ea132001bcb049e7ee67fc903af8283d91727cb27b0fdafe5e460
- SSDEEP 6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7nJ69h2VEXwAEwgFRncM2SxSd68FARY1RO40Q:/U5rCOTeiDJm2ViD0uOSz7w0bDNZ
- TLSH T10DB4F0267545C436E69312708EE6DB722D3A7D308B26A4CB3B90366E6FB02D0D7B4347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5864 360F.tmp 5112 369B.tmp 1496 3757.tmp 4888 3822.tmp 3868 38AF.tmp 5776 395B.tmp 5160 39C8.tmp 956 3A93.tmp 1392 3B5E.tmp 416 3BDB.tmp 1712 3C87.tmp 800 3D43.tmp 3580 3DFE.tmp 1200 3ED9.tmp 5304 3FB4.tmp 4996 405F.tmp 5284 40DC.tmp 5816 414A.tmp 4876 41F6.tmp 3024 42A2.tmp 1620 42F0.tmp 5216 433E.tmp 3696 438C.tmp 3168 43DA.tmp 1648 44E4.tmp 1708 4561.tmp 4016 45BE.tmp 1476 467A.tmp 5012 4726.tmp 5756 4793.tmp 1628 482F.tmp 5732 48AC.tmp 4560 4939.tmp 3952 49A6.tmp 3496 4A04.tmp 5920 4A72.tmp 5212 4AC0.tmp 1756 4B2D.tmp 1800 4B8B.tmp 5004 4BE9.tmp 456 4C37.tmp 5812 4CB4.tmp 5932 4D02.tmp 5360 4D60.tmp 3016 4DAE.tmp 4244 4E0B.tmp 5376 4E5A.tmp 2944 4EC7.tmp 1208 4F15.tmp 3972 4F82.tmp 4152 4FD1.tmp 2172 502E.tmp 4436 507C.tmp 4144 50CB.tmp 3820 5119.tmp 2108 5186.tmp 4304 51F3.tmp 2080 5242.tmp 5260 52AF.tmp 3424 52FD.tmp 2756 536A.tmp 3020 53E7.tmp 64 5436.tmp 3284 54A3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 536A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B62C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 5864 4580 2026-08-01_065936aba97131cf14b9dde1fa5fc1c7_elex_mafia_stealc_tofsee.exe 85 PID 5864 wrote to memory of 5112 5864 360F.tmp 86 PID 5112 wrote to memory of 1496 5112 369B.tmp 87 PID 1496 wrote to memory of 4888 1496 3757.tmp 88 PID 4888 wrote to memory of 3868 4888 3822.tmp 89 PID 3868 wrote to memory of 5776 3868 38AF.tmp 90 PID 5776 wrote to memory of 5160 5776 395B.tmp 91 PID 5160 wrote to memory of 956 5160 39C8.tmp 92 PID 956 wrote to memory of 1392 956 3A93.tmp 93 PID 1392 wrote to memory of 416 1392 3B5E.tmp 94 PID 416 wrote to memory of 1712 416 3BDB.tmp 95 PID 1712 wrote to memory of 800 1712 3C87.tmp 96 PID 800 wrote to memory of 3580 800 3D43.tmp 97 PID 3580 wrote to memory of 1200 3580 3DFE.tmp 98 PID 1200 wrote to memory of 5304 1200 3ED9.tmp 99 PID 5304 wrote to memory of 4996 5304 3FB4.tmp 100 PID 4996 wrote to memory of 5284 4996 405F.tmp 101 PID 5284 wrote to memory of 5816 5284 40DC.tmp 102 PID 5816 wrote to memory of 4876 5816 414A.tmp 103 PID 4876 wrote to memory of 3024 4876 41F6.tmp 104 PID 3024 wrote to memory of 1620 3024 42A2.tmp 105 PID 1620 wrote to memory of 5216 1620 42F0.tmp 106 PID 5216 wrote to memory of 3696 5216 433E.tmp 107 PID 3696 wrote to memory of 3168 3696 438C.tmp 108 PID 3168 wrote to memory of 1648 3168 43DA.tmp 109 PID 1648 wrote to memory of 1708 1648 44E4.tmp 110 PID 1708 wrote to memory of 4016 1708 4561.tmp 111 PID 4016 wrote to memory of 1476 4016 45BE.tmp 112 PID 1476 wrote to memory of 5012 1476 467A.tmp 113 PID 5012 wrote to memory of 5756 5012 4726.tmp 114 PID 5756 wrote to memory of 1628 5756 4793.tmp 115 PID 1628 wrote to memory of 5732 1628 482F.tmp 116 PID 5732 wrote to memory of 4560 5732 48AC.tmp 117 PID 4560 wrote to memory of 3952 4560 4939.tmp 118 PID 3952 wrote to memory of 3496 3952 49A6.tmp 119 PID 3496 wrote to memory of 5920 3496 4A04.tmp 120 PID 5920 wrote to memory of 5212 5920 4A72.tmp 121 PID 5212 wrote to memory of 1756 5212 4AC0.tmp 122 PID 1756 wrote to memory of 1800 1756 4B2D.tmp 123 PID 1800 wrote to memory of 5004 1800 4B8B.tmp 124 PID 5004 wrote to memory of 456 5004 4BE9.tmp 125 PID 456 wrote to memory of 5812 456 4C37.tmp 126 PID 5812 wrote to memory of 5932 5812 4CB4.tmp 127 PID 5932 wrote to memory of 5360 5932 4D02.tmp 128 PID 5360 wrote to memory of 3016 5360 4D60.tmp 129 PID 3016 wrote to memory of 4244 3016 4DAE.tmp 130 PID 4244 wrote to memory of 5376 4244 4E0B.tmp 131 PID 5376 wrote to memory of 2944 5376 4E5A.tmp 132 PID 2944 wrote to memory of 1208 2944 4EC7.tmp 133 PID 1208 wrote to memory of 3972 1208 4F15.tmp 134 PID 3972 wrote to memory of 4152 3972 4F82.tmp 135 PID 4152 wrote to memory of 2172 4152 4FD1.tmp 136 PID 2172 wrote to memory of 4436 2172 502E.tmp 137 PID 4436 wrote to memory of 4144 4436 507C.tmp 138 PID 4144 wrote to memory of 3820 4144 50CB.tmp 139 PID 3820 wrote to memory of 2108 3820 5119.tmp 140 PID 2108 wrote to memory of 4304 2108 5186.tmp 141 PID 4304 wrote to memory of 2080 4304 51F3.tmp 142 PID 2080 wrote to memory of 5260 2080 5242.tmp 143 PID 5260 wrote to memory of 3424 5260 52AF.tmp 144 PID 3424 wrote to memory of 2756 3424 52FD.tmp 145 PID 2756 wrote to memory of 3020 2756 536A.tmp 146 PID 3020 wrote to memory of 64 3020 53E7.tmp 147 PID 64 wrote to memory of 3284 64 5436.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_065936aba97131cf14b9dde1fa5fc1c7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_065936aba97131cf14b9dde1fa5fc1c7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\395B.tmp"C:\Users\Admin\AppData\Local\Temp\395B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"65⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"66⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"67⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"68⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\561A.tmp"C:\Users\Admin\AppData\Local\Temp\561A.tmp"69⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\5668.tmp"C:\Users\Admin\AppData\Local\Temp\5668.tmp"70⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"71⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"72⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"73⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"74⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"75⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"76⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"78⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"79⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"80⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"81⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"82⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"83⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"84⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"85⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"86⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"87⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"88⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"89⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"90⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"91⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"92⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"93⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"94⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"95⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"96⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"97⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"98⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"99⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"100⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"101⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"102⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"103⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"104⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"105⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"106⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"107⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"108⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"109⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"110⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"111⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"112⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\659B.tmp"C:\Users\Admin\AppData\Local\Temp\659B.tmp"113⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"114⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"115⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"116⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\66F2.tmp"C:\Users\Admin\AppData\Local\Temp\66F2.tmp"117⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"118⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\67AE.tmp"C:\Users\Admin\AppData\Local\Temp\67AE.tmp"119⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"120⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"121⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-